8000 fix(settings): keep oauth client secrets out of a private export by hanthor · Pull Request #597 · hyprlab/hylki · GitHub
[go: up one dir, main page]
Skip to content

fix(settings): keep oauth client secrets out of a private export #597

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
hanthor wants to merge 2 commits into
base: main
Choose a base branch
from
+231 −78
Open

fix(settings): keep oauth client secrets out of a private export #597

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a997ad8
fix(settings): keep oauth client secrets out of a private export
hanthor Nov 5, 2026
551a665
docs(settings): say the export leaves out oauth client secrets
hanthor Nov 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,10 @@

## Unreleased

- **Fixed: Export settings wrote OAuth client secrets, readable by anyone on
the computer.** The file is now readable only by you and leaves the secrets
out. Importing it keeps the secret this computer already has.

- **Fixed: `w` and `b` left a message card under the bar above it** (#587, by
James Reilly). The card's top border and selection outline were cut off. The
card now stops 14 px below the bar, as it does when focused for a reply.
Expand Down
6 changes: 6 additions & 0 deletions docs/DOCUMENTATION.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2474,6 +2474,12 @@ views' caches in `~/.cache/hylki/`, and account pictures in
Passwords and tokens are never in those files: they go to the system keyring
through the Secret Service. Decrypted OpenPGP messages are never cached at all.

**Settings → Backup → Export settings** writes a file only you can
read. It carries no passwords or tokens, and no OAuth client secret either:
importing it on the same computer keeps the secret already there, and on
another one, an account with its own OAuth client needs the secret typed in
again.

**Remote content**, once allowed for a message, is fetched by Hylki itself, with
no cookies and no Referer, and kept in `~/.cache/hylki/remote/` for a week, up
to 2 GB, so a message shown again does not fetch it again. **Settings →
Expand Down
17 changes: 11 additions & 6 deletions po/ca.po
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1044,6 +1044,9 @@ msgstr "Missatge nou a partir d'una plantilla"
msgid "Send the message you are writing"
msgstr "Envia el missatge que estàs escrivint"

#. Save Draft, Save as Template and Delete Draft are not here:
#. the Save Draft button and its arrow stay in the header at
#. any width.
msgid "Attach files"
msgstr "Adjunta fitxers"

Expand Down Expand Up @@ -3468,8 +3471,8 @@ msgid ""
"1. At dropbox.com/developers/apps, press Create app.\n"
"2. Choose Scoped access, then App folder or Full Dropbox.\n"
"3. Give it a name no one else has used and press Create app.\n"
"4. On Permissions, tick account_info.read, files.content.write and "
"sharing.write, then press Submit.\n"
"4. On Permissions, tick account_info.read, files.content.write and sharing."
"write, then press Submit.\n"
"5. On Settings, under OAuth 2, add the redirect URI {uri} and press Add.\n"
"6. Copy the App key into the field above.\n"
"Development status is enough. Leave the field empty to use this build's own "
Expand All @@ -3479,8 +3482,8 @@ msgstr ""
"1. A dropbox.com/developers/apps, prem Create app.\n"
"2. Tria Scoped access, i després App folder o Full Dropbox.\n"
"3. Dona-li un nom que ningú més no hagi fet servir i prem Create app.\n"
"4. A Permissions, marca account_info.read, files.content.write i "
"sharing.write, i després prem Submit.\n"
"4. A Permissions, marca account_info.read, files.content.write i sharing."
"write, i després prem Submit.\n"
"5. A Settings, sota OAuth 2, afegeix l'URI de redirecció {uri} i prem Add.\n"
"6. Copia l'App key al camp de dalt.\n"
"L'estat Development és suficient. Deixa el camp buit per utilitzar la clau "
Expand Down Expand Up @@ -6175,6 +6178,7 @@ msgstr "Traducció"
msgid "General"
msgstr "General"

#. Rendered as Pango markup — a bare "&" breaks it.
msgid "Appearance"
msgstr "Aparença"

Expand Down Expand Up @@ -6343,9 +6347,10 @@ msgstr ""
msgid "Reset"
msgstr ""

#, fuzzy
msgid ""
"Accounts, preferences, filters, tags and layout, in one file. Passwords and "
"OpenPGP keys are not included."
"Accounts, preferences, filters, tags and layout, in one file. Passwords, "
"OAuth client secrets and OpenPGP keys are not included."
msgstr ""
"Comptes, preferències, filtres, etiquetes i disposició, en un sol fitxer. "
"Les contrasenyes i les claus OpenPGP no s'inclouen."
Expand Down
17 changes: 11 additions & 6 deletions po/de.po
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1037,6 +1037,9 @@ msgstr "Neue Nachricht aus Vorlage"
msgid "Send the message you are writing"
msgstr "Geschriebene Nachricht senden"

#. Save Draft, Save as Template and Delete Draft are not here:
#. the Save Draft button and its arrow stay in the header at
#. any width.
msgid "Attach files"
msgstr "Dateien anhängen"

Expand Down Expand Up @@ -3433,8 +3436,8 @@ msgid ""
"1. At dropbox.com/developers/apps, press Create app.\n"
"2. Choose Scoped access, then App folder or Full Dropbox.\n"
"3. Give it a name no one else has used and press Create app.\n"
"4. On Permissions, tick account_info.read, files.content.write and "
"sharing.write, then press Submit.\n"
"4. On Permissions, tick account_info.read, files.content.write and sharing."
"write, then press Submit.\n"
"5. On Settings, under OAuth 2, add the redirect URI {uri} and press Add.\n"
"6. Copy the App key into the field above.\n"
"Development status is enough. Leave the field empty to use this build's own "
Expand All @@ -3447,8 +3450,8 @@ msgstr ""
"2. »Scoped access« und anschließend »App folder« oder »Full Dropbox« \n"
"3. Einen eindeutigen App-Namen vergeben (z. B. Hylki für [Name]) und auf "
"»Create app« klicken.\n"
"4. Auf dem Reiter »Permissions« die Berechtigungen account_info.read, "
"files.content.write und sharing.write aktivieren und auf »Submit« klicken.\n"
"4. Auf dem Reiter »Permissions« die Berechtigungen account_info.read, files."
"content.write und sharing.write aktivieren und auf »Submit« klicken.\n"
"5. Auf dem Reiter »Settings« unter »OAuth 2« die Weiterleitungs-URI {uri} "
"eingeben und auf »Add« klicken.\n"
"6. Den App-Schlüssel (»App key«) oben vom Reiter »Settings« in das obere "
Expand Down Expand Up @@ -6131,6 +6134,7 @@ msgstr "Übersetzung"
msgid "General"
msgstr "Allgemein"

#. Rendered as Pango markup — a bare "&" breaks it.
msgid "Appearance"
msgstr "Aussehen"

Expand Down Expand Up @@ -6299,9 +6303,10 @@ msgstr ""
msgid "Reset"
msgstr ""

#, fuzzy
msgid ""
"Accounts, preferences, filters, tags and layout, in one file. Passwords and "
"OpenPGP keys are not included."
"Accounts, preferences, filters, tags and layout, in one file. Passwords, "
"OAuth client secrets and OpenPGP keys are not included."
msgstr ""
"Konten, Einstellungen, Filter, Tags und Layout in einer Datei. Passwörter "
"und OpenPGP-Schlüssel sind nicht enthalten."
Expand Down
17 changes: 11 additions & 6 deletions po/el.po
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1034,6 +1034,9 @@ msgstr "Νέο μήνυμα από πρότυπο"
msgid "Send the message you are writing"
msgstr "Αποστολή του μηνύματος που συντάσσετε"

#. Save Draft, Save as Template and Delete Draft are not here:
#. the Save Draft button and its arrow stay in the header at
#. any width.
msgid "Attach files"
msgstr "Επισύναψη αρχείων"

Expand Down Expand Up @@ -3437,8 +3440,8 @@ msgid ""
"1. At dropbox.com/developers/apps, press Create app.\n"
"2. Choose Scoped access, then App folder or Full Dropbox.\n"
"3. Give it a name no one else has used and press Create app.\n"
"4. On Permissions, tick account_info.read, files.content.write and "
"sharing.write, then press Submit.\n"
"4. On Permissions, tick account_info.read, files.content.write and sharing."
"write, then press Submit.\n"
"5. On Settings, under OAuth 2, add the redirect URI {uri} and press Add.\n"
"6. Copy the App key into the field above.\n"
"Development status is enough. Leave the field empty to use this build's own "
Expand Down Expand Up @@ -3864,8 +3867,8 @@ msgstr "Προγραμματισμός"

msgid "The From has to be one address, such as Ann <ann@example.com>."
msgstr ""
"Το πεδίο αποστολέα πρέπει να περιέχει μία διεύθυνση, όπως Ann "
"<ann@example.com>."
"Το πεδίο αποστολέα πρέπει να περιέχει μία διεύθυνση, όπως Ann <ann@example."
"com>."

msgid "“{address}” is not an email address."
msgstr "Το «{address}» δεν είναι διεύθυνση email."
Expand Down Expand Up @@ -6142,6 +6145,7 @@ msgstr "Μετάφραση"
msgid "General"
msgstr "Γενικά"

#. Rendered as Pango markup — a bare "&" breaks it.
msgid "Appearance"
msgstr "Εμφάνιση"

Expand Down Expand Up @@ -6310,9 +6314,10 @@ msgstr ""
msgid "Reset"
msgstr ""

#, fuzzy
msgid ""
"Accounts, preferences, filters, tags and layout, in one file. Passwords and "
"OpenPGP keys are not included."
"Accounts, preferences, filters, tags and layout, in one file. Passwords, "
"OAuth client secrets and OpenPGP keys are not included."
msgstr ""
"Λογαριασμοί, προτιμήσεις, φίλτρα, ετικέτες και διάταξη σε ένα αρχείο. Δεν "
"περιλαμβάνονται κωδικοί πρόσβασης και κλειδιά OpenPGP."
Expand Down
17 changes: 11 additions & 6 deletions po/es.po
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1034,6 +1034,9 @@ msgstr "Mensaje nuevo a partir de una plantilla"
msgid "Send the message you are writing"
msgstr "Enviar el mensaje que estás escribiendo"

#. Save Draft, Save as Template and Delete Draft are not here:
#. the Save Draft button and its arrow stay in the header at
#. any width.
msgid "Attach files"
msgstr "Adjuntar archivos"

Expand Down Expand Up @@ -3412,8 +3415,8 @@ msgid ""
"1. At dropbox.com/developers/apps, press Create app.\n"
"2. Choose Scoped access, then App folder or Full Dropbox.\n"
"3. Give it a name no one else has used and press Create app.\n"
"4. On Permissions, tick account_info.read, files.content.write and "
"sharing.write, then press Submit.\n"
"4. On Permissions, tick account_info.read, files.content.write and sharing."
"write, then press Submit.\n"
"5. On Settings, under OAuth 2, add the redirect URI {uri} and press Add.\n"
"6. Copy the App key into the field above.\n"
"Development status is enough. Leave the field empty to use this build's own "
Expand All @@ -3424,8 +3427,8 @@ msgstr ""
"2. Elige Acceso con ámbitos y después Carpeta de aplicación o Dropbox "
"completo.\n"
"3. Asígnale un nombre que nadie haya utilizado y pulsa Crear aplicación.\n"
"4. En Permisos, marca account_info.read, files.content.write y "
"sharing.write; pulsa Enviar.\n"
"4. En Permisos, marca account_info.read, files.content.write y sharing."
"write; pulsa Enviar.\n"
"5. En Ajustes, dentro de OAuth 2, añade la URI de redirección {uri} y pulsa "
"Añadir.\n"
"6. Copia la clave de la aplicación en el campo anterior.\n"
Expand Down Expand Up @@ -6112,6 +6115,7 @@ msgstr "Traducción"
msgid "General"
msgstr "General"

#. Rendered as Pango markup — a bare "&" breaks it.
msgid "Appearance"
msgstr "Apariencia"

Expand Down Expand Up @@ -6280,9 +6284,10 @@ msgstr ""
msgid "Reset"
msgstr ""

#, fuzzy
msgid ""
"Accounts, preferences, filters, tags and layout, in one file. Passwords and "
"OpenPGP keys are not included."
"Accounts, preferences, filters, tags and layout, in one file. Passwords, "
"OAuth client secrets and OpenPGP keys are not included."
msgstr ""
"Cuentas, preferencias, filtros, etiquetas y disposición en un único archivo. "
"No incluye contraseñas ni claves OpenPGP."
Expand Down
33 changes: 19 additions & 14 deletions po/fr.po
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1031,6 +1031,9 @@ msgstr "Nouveau message à partir d’un modèle"
msgid "Send the message you are writing"
msgstr "Envoyer le message en cours de rédaction"

#. Save Draft, Save as Template and Delete Draft are not here:
#. the Save Draft button and its arrow stay in the header at
#. any width.
msgid "Attach files"
msgstr "Joindre des fichiers"

Expand Down Expand Up @@ -3425,8 +3428,8 @@ msgid ""
"1. At dropbox.com/developers/apps, press Create app.\n"
"2. Choose Scoped access, then App folder or Full Dropbox.\n"
"3. Give it a name no one else has used and press Create app.\n"
"4. On Permissions, tick account_info.read, files.content.write and "
"sharing.write, then press Submit.\n"
"4. On Permissions, tick account_info.read, files.content.write and sharing."
"write, then press Submit.\n"
"5. On Settings, under OAuth 2, add the redirect URI {uri} and press Add.\n"
"6. Copy the App key into the field above.\n"
"Development status is enough. Leave the field empty to use this build's own "
Expand Down Expand Up @@ -3825,9 +3828,9 @@ msgid ""
"There is no OpenPGP key of your own for {addr}. Generate one under Settings, "
"OpenPGP, or choose a key in the account's settings."
msgstr ""
"Il n’y a pas de clé OpenPGP associée à {addr}. Générez-en une dans "
"« Paramètres », puis « OpenPGP », ou sélectionnez une clé dans les "
"paramètres du compte."
"Il n’y a pas de clé OpenPGP associée à {addr}. Générez-en une dans « "
"Paramètres », puis « OpenPGP », ou sélectionnez une clé dans les paramètres "
"du compte."

msgid ""
"There is no OpenPGP key for {addr}. Ask them for their public key, or fetch "
Expand All @@ -3844,8 +3847,8 @@ msgstr "Programmer"

msgid "The From has to be one address, such as Ann <ann@example.com>."
msgstr ""
"Le champ De doit contenir une seule adresse, par exemple Anne "
"<anne@example.com>."
"Le champ De doit contenir une seule adresse, par exemple Anne <anne@example."
"com>."

msgid "“{address}” is not an email address."
msgstr "« {address} » n’est pas une adresse e-mail."
Expand Down Expand Up @@ -6125,6 +6128,7 @@ msgstr "Traduction"
msgid "General"
msgstr "Général"

#. Rendered as Pango markup — a bare "&" breaks it.
msgid "Appearance"
msgstr "Apparence"

Expand Down Expand Up @@ -6293,9 +6297,10 @@ msgstr ""
msgid "Reset"
msgstr ""

#, fuzzy
msgid ""
"Accounts, preferences, filters, tags and layout, in one file. Passwords and "
"OpenPGP keys are not included."
"Accounts, preferences, filters, tags and layout, in one file. Passwords, "
"OAuth client secrets and OpenPGP keys are not included."
msgstr ""
"Comptes, préférences, filtres, tags et mise en page, dans un seul fichier. "
"Les mots de passe et les clés OpenPGP ne sont pas inclus."
Expand Down Expand Up @@ -8694,9 +8699,9 @@ msgstr "Hyprlab"
#~ "the desktop's own choice; \"Ask each time\" lets the desktop ask before "
#~ "each one."
#~ msgstr ""
#~ "Le navigateur dans lequel s’ouvre un lien contenu dans un message. "
#~ "« Système par défaut » suit le choix du bureau ; « Demander à chaque "
#~ "fois » laisse le bureau demander avant chaque ouverture."
#~ "Le navigateur dans lequel s’ouvre un lien contenu dans un message. « "
#~ "Système par défaut » suit le choix du bureau ; « Demander à chaque fois » "
#~ "laisse le bureau demander avant chaque ouverture."

#~ msgid ""
#~ "Installed, but the nautilus-python package is missing, so Files cannot "
Expand Down Expand Up @@ -8951,8 +8956,8 @@ msgstr "Hyprlab"
#~ "Accounts."
#~ msgstr ""
#~ "OneDrive se connecte via le compte des Comptes en ligne de GNOME choisi "
#~ "ci-dessus ; il n’y a pas de mot de passe à saisir. Un compte marqué "
#~ "« Fichiers désactivé » fonctionne quand même ici, mais vous pouvez "
#~ "ci-dessus ; il n’y a pas de mot de passe à saisir. Un compte marqué « "
#~ "Fichiers désactivé » fonctionne quand même ici, mais vous pouvez "
#~ "souhaiter activer Fichiers pour ce compte dans Paramètres, Comptes en "
#~ "ligne."

Expand Down
16 changes: 10 additions & 6 deletions po/hu.po
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1073,6 +1073,9 @@ msgstr "Legújabb üzenet elöl"
msgid "Send the message you are writing"
msgstr "Küldd el az éppen írt üzenetet"

#. Save Draft, Save as Template and Delete Draft are not here:
#. the Save Draft button and its arrow stay in the header at
#. any width.
msgid "Attach files"
msgstr "Fájlok csatolása"

Expand Down Expand Up @@ -3585,8 +3588,8 @@ msgid ""
"1. At dropbox.com/developers/apps, press Create app.\n"
"2. Choose Scoped access, then App folder or Full Dropbox.\n"
"3. Give it a name no one else has used and press Create app.\n"
"4. On Permissions, tick account_info.read, files.content.write and "
"sharing.write, then press Submit.\n"
"4. On Permissions, tick account_info.read, files.content.write and sharing."
"write, then press Submit.\n"
"5. On Settings, under OAuth 2, add the redirect URI {uri} and press Add.\n"
"6. Copy the App key into the field above.\n"
"Development status is enough. Leave the field empty to use this build's own "
Expand Down Expand Up @@ -4265,8 +4268,8 @@ msgstr ""

msgid "Sign in as, such as cn=jane,ou=people,dc=example,dc=com"
msgstr ""
"Jelentkezzen be például a következő névvel: "
"cn=jane,ou=people,dc=example,dc=com"
"Jelentkezzen be például a következő névvel: cn=jane,ou=people,dc=example,"
"dc=com"

msgid "Enter the directory's server."
msgstr "Lépjen be a könyvtár kiszolgálójára."
Expand Down Expand Up @@ -6402,6 +6405,7 @@ msgstr "Fordította"
msgid "General"
msgstr "Általános"

#. Rendered as Pango markup — a bare "&" breaks it.
msgid "Appearance"
msgstr "Megjelenés"

Expand Down Expand Up @@ -6574,8 +6578,8 @@ msgstr ""

#, fuzzy
msgid ""
"Accounts, preferences, filters, tags and layout, in one file. Passwords and "
"OpenPGP keys are not included."
"Accounts, preferences, filters, tags and layout, in one file. Passwords, "
"OAuth client secrets and OpenPGP keys are not included."
msgstr ""
"Fiókok és beállítások egyetlen fájlban. A jelszavak a rendszer kulcstartóján "
"maradnak, és soha nem kerülnek exportálásra."
Expand Down
Loading
0